CloudOTP Authenticator

Open-source TOTP/HOTP authenticator for Windows desktop, Android, and Web with QR import/export, local-only storage, and optional cloud sync.

中文 README

CloudOTP is built for people who want OTP codes available on their PC without being locked into one device or one vendor. Use it as a Windows desktop authenticator, open the web version when needed, or install the Android APK from GitHub Releases.

Install

Windows

Install CloudOTP from the Microsoft Store:

You can also install it from Microsoft Store with winget:

winget install --source msstore --id 9PLD5R9RPWPX --accept-source-agreements --accept-package-agreements

Web

Use the browser version at https://cloudotp.top/.

Android

Download the APK from the latest GitHub Release.

Choose the APK for your device:

• arm64-v8a: most modern Android phones
• armeabi-v7a: older 32-bit Android phones
• x86_64: emulators and some Chromebook devices

Build from source

Install Flutter, then run:

git clone https://github.com/jingcjie/CloudOTP.git
cd CloudOTP
flutter pub get

Run locally:

flutter run -d windows
flutter run -d chrome
flutter run

Manual release builds:

flutter build apk --split-per-abi
dart run msix:create
flutter build web

Features

• Windows desktop authenticator available from Microsoft Store
• TOTP and HOTP code generation
• QR scan, image import, and manual account setup
• QR export for backup, transfer, and migration to other authenticators
• Local-only mode for device storage
• Optional cloud sync for backup and restore
• Light and dark themes
• English, Chinese, Spanish, French, and German UI
• MIT licensed source code

Security Model

CloudOTP supports local mode and optional cloud sync.

In local mode, OTP data is stored on the current device. Removing app data can remove locally stored OTP entries, so keep your own backup if you rely on local-only mode.

Cloud sync is optional. Cloud data is isolated per account with Supabase authentication and Row-Level Security policies. Client-side encryption for cloud sync is planned, so the project does not currently describe cloud sync as end-to-end encrypted.

QR export is designed to prevent lock-in: you can export accounts and move them to another authenticator at any time.

Compatibility

Current release targets:

• Windows 10/11
• Android APK from GitHub Releases
• Web browser at cloudotp.top

Contributing

Contributions are welcome. Please open an issue or submit a pull request.

License

CloudOTP is licensed under the MIT License.

Acknowledgements

• Dart
• Flutter
• OTP RFC 6238
• HOTP RFC 4226